7 files changed, 16 insertions, 10 deletions

diff --git a/drivers/isdn/hardware/mISDN/avmfritz.c b/drivers/isdn/hardware/mISDN/avmfritz.c
index fa6ca4733725..dceaec821b0e 100644
--- a/drivers/isdn/hardware/mISDN/avmfritz.c
+++ b/drivers/isdn/hardware/mISDN/avmfritz.c
@@ -857,8 +857,9 @@ avm_bctrl(struct mISDNchannel *ch, u32 cmd, void *arg)
         switch (cmd) {
         case CLOSE_CHANNEL:
                 test_and_clear_bit(FLG_OPEN, &bch->Flags);
+                cancel_work_sync(&bch->workq);
                 spin_lock_irqsave(&fc->lock, flags);
-                mISDN_freebchannel(bch);
+                mISDN_clear_bchannel(bch);
                 modehdlc(bch, ISDN_P_NONE);
                 spin_unlock_irqrestore(&fc->lock, flags);
                 ch->protocol = ISDN_P_NONE;
diff --git a/drivers/isdn/hardware/mISDN/hfcmulti.c b/drivers/isdn/hardware/mISDN/hfcmulti.c
index 5e402cf2e795..f02794203bb1 100644
--- a/drivers/isdn/hardware/mISDN/hfcmulti.c
+++ b/drivers/isdn/hardware/mISDN/hfcmulti.c
@@ -5059,6 +5059,7 @@ hfcmulti_init(struct hm_map *m, struct pci_dev *pdev,
                                 printk(KERN_INFO
                                        "HFC-E1 #%d has overlapping B-channels on fragment #%d\n",
                                        E1_cnt + 1, pt);
+                                kfree(hc);
                                 return -EINVAL;
                         }
                         maskcheck |= hc->bmask[pt];
@@ -5086,6 +5087,7 @@ hfcmulti_init(struct hm_map *m, struct pci_dev *pdev,
         if ((poll >> 1) > sizeof(hc->silence_data)) {
                 printk(KERN_ERR "HFCMULTI error: silence_data too small, "
                        "please fix\n");
+                kfree(hc);
                 return -EINVAL;
         }
         for (i = 0; i < (poll >> 1); i++)
diff --git a/drivers/isdn/hardware/mISDN/mISDNipac.c b/drivers/isdn/hardware/mISDN/mISDNipac.c
index 752e0825591f..ccd7d851be26 100644
--- a/drivers/isdn/hardware/mISDN/mISDNipac.c
+++ b/drivers/isdn/hardware/mISDN/mISDNipac.c
@@ -1406,8 +1406,9 @@ hscx_bctrl(struct mISDNchannel *ch, u32 cmd, void *arg)
         switch (cmd) {
         case CLOSE_CHANNEL:
                 test_and_clear_bit(FLG_OPEN, &bch->Flags);
+                cancel_work_sync(&bch->workq);
                 spin_lock_irqsave(hx->ip->hwlock, flags);
-                mISDN_freebchannel(bch);
+                mISDN_clear_bchannel(bch);
                 hscx_mode(hx, ISDN_P_NONE);
                 spin_unlock_irqrestore(hx->ip->hwlock, flags);
                 ch->protocol = ISDN_P_NONE;
diff --git a/drivers/isdn/hardware/mISDN/mISDNisar.c b/drivers/isdn/hardware/mISDN/mISDNisar.c
index be5973ded6d6..182ecf0626c2 100644
--- a/drivers/isdn/hardware/mISDN/mISDNisar.c
+++ b/drivers/isdn/hardware/mISDN/mISDNisar.c
@@ -1588,8 +1588,9 @@ isar_bctrl(struct mISDNchannel *ch, u32 cmd, void *arg)
         switch (cmd) {
         case CLOSE_CHANNEL:
                 test_and_clear_bit(FLG_OPEN, &bch->Flags);
+                cancel_work_sync(&bch->workq);
                 spin_lock_irqsave(ich->is->hwlock, flags);
-                mISDN_freebchannel(bch);
+                mISDN_clear_bchannel(bch);
                 modeisar(ich, ISDN_P_NONE);
                 spin_unlock_irqrestore(ich->is->hwlock, flags);
                 ch->protocol = ISDN_P_NONE;
diff --git a/drivers/isdn/hardware/mISDN/netjet.c b/drivers/isdn/hardware/mISDN/netjet.c
index c3e3e7686273..9bcade59eb73 100644
--- a/drivers/isdn/hardware/mISDN/netjet.c
+++ b/drivers/isdn/hardware/mISDN/netjet.c
@@ -812,8 +812,9 @@ nj_bctrl(struct mISDNchannel *ch, u32 cmd, void *arg)
         switch (cmd) {
         case CLOSE_CHANNEL:
                 test_and_clear_bit(FLG_OPEN, &bch->Flags);
+                cancel_work_sync(&bch->workq);
                 spin_lock_irqsave(&card->lock, flags);
-                mISDN_freebchannel(bch);
+                mISDN_clear_bchannel(bch);
                 mode_tiger(bc, ISDN_P_NONE);
                 spin_unlock_irqrestore(&card->lock, flags);
                 ch->protocol = ISDN_P_NONE;
diff --git a/drivers/isdn/hardware/mISDN/w6692.c b/drivers/isdn/hardware/mISDN/w6692.c
index 26a86b846099..335fe6455002 100644
--- a/drivers/isdn/hardware/mISDN/w6692.c
+++ b/drivers/isdn/hardware/mISDN/w6692.c
@@ -1054,8 +1054,9 @@ w6692_bctrl(struct mISDNchannel *ch, u32 cmd, void *arg)
         switch (cmd) {
         case CLOSE_CHANNEL:
                 test_and_clear_bit(FLG_OPEN, &bch->Flags);
+                cancel_work_sync(&bch->workq);
                 spin_lock_irqsave(&card->lock, flags);
-                mISDN_freebchannel(bch);
+                mISDN_clear_bchannel(bch);
                 w6692_mode(bc, ISDN_P_NONE);
                 spin_unlock_irqrestore(&card->lock, flags);
                 ch->protocol = ISDN_P_NONE;
diff --git a/drivers/isdn/mISDN/hwchannel.c b/drivers/isdn/mISDN/hwchannel.c
index ef34fd40867c..2602be23f341 100644
--- a/drivers/isdn/mISDN/hwchannel.c
+++ b/drivers/isdn/mISDN/hwchannel.c
@@ -148,17 +148,16 @@ mISDN_clear_bchannel(struct bchannel *ch)
         ch->next_minlen = ch->init_minlen;
         ch->maxlen = ch->init_maxlen;
         ch->next_maxlen = ch->init_maxlen;
+        skb_queue_purge(&ch->rqueue);
+        ch->rcount = 0;
 }
 EXPORT_SYMBOL(mISDN_clear_bchannel);
 
-int
+void
 mISDN_freebchannel(struct bchannel *ch)
 {
+        cancel_work_sync(&ch->workq);
         mISDN_clear_bchannel(ch);
-        skb_queue_purge(&ch->rqueue);
-        ch->rcount = 0;
-        flush_work_sync(&ch->workq);
-        return 0;
 }
 EXPORT_SYMBOL(mISDN_freebchannel);